Hey everyone,
I am windering if anyone can help me with these two questions:
1. I am using ossec-logtest file to test my rules in order to match with
some Windows logs. Does anyone know in which order are the rules tested?
It seems it is not ID number order..
2. Here is the default predefined rule that mathes all windows events:
<group name="windows,">
<rule id="18100" level="6">
<category>windows</category>
<description>Group of windows rules.</description>
</rule>
How is this being linked with windows events logs decoder in
ossec/etc/decoder.xml? Can anyone explain why is this matching all windows
events? Is it through the category tag? Because there is no "match" tag..
Thanks a lot!!
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
